The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is primarily designed to ingest and process untrusted codebase data for auditing purposes.
Ingestion points: The target repository root as defined in the SKILL.md frontmatter and reconnaissance phases.
Boundary markers: The skill mandates strict "Universal execution safety" rules, including OS-enforced sandboxing, empty environments, and isolation between hunter and verifier agents.
Capability inventory: The agent performs extensive read/write operations on the local file system (to specific scratch and output directories) and may execute target-controlled builds or tests within the specified sandbox.
Sanitization: Findings are validated against a formal JSON schema (report-schema.json) and verified by independent agents in Phase 3 and Phase 5.
[DYNAMIC_EXECUTION]: The workflow permits the execution of arbitrary target-controlled processes (e.g., fuzzers, unit tests, build scripts) during Phase 2. This risk is mitigated by the skill's own internal rules requiring an OS-enforced sandbox that disables external networking and provides a read-only view of the target codebase and toolchain.
[COMMAND_EXECUTION]: The skill uses node to execute local validation scripts for findings and coverage ledgers. Specifically, it references validate-findings.cjs and validate-coverage-ledger.cjs in the SKILL.md and VALIDATION-AND-REPORTING.md instructions. These scripts are intended to be local to the skill directory to ensure the integrity of the audit artifacts.

security-audit